The encryption plays a vital role in networking. It secures the traffic between your router and your wireless device, thus ensuring nobody can spy on your actions or inject malicious code into the transfer.

Now its perfect record lays in ruins. And so too does the security of billions of Wi-Fi networks around the world.

How Does a KRACK Attack Work?

Perhaps the most worrying aspect of KRACK is that it’s not focused on a particular range of devices or a specific type of security implementation. The issue affects the Wi-Fi protocol itself, and thus affects every internet-connected device you own.

WPA-2 encryption uses a “four-way handshake” to establish a device’s connection to the network. It’s this “handshake” that the KRACK attack targets.

The first two parts of the four-part process ensure the password on a device matches the Wi-Fi’s security key. The device and router communicate with each other, and if the credentials agree, the third part of the handshake initializes.

At this point, a new encryption key is generated. Theoretically, it’s designed to protect a user’s session by encrypting data frames. This is where the KRACK attack kicks into action. Vanhoef’s research shows a hacker can intercept and manipulate the new key.

The hack works because a router (or other access point) will try and retransmit the new key several times if it does not receive a response from the device. Because each retransmission uses the same encryption key, it resets the transmit packet number and receive replay counter.

An attacker can collect the messages and force the counters to reset. In turn, this allows the person to replay, decrypt, or forge packets.

TL;DR: KRACK allows an attacker to steal and use one of the encryption keys that Wi-Fi network security relies on.

What Can Hackers Do With KRACK?

Let’s start with the good news. KRACK attacks are difficult for hackers to deploy for one simple reason: they need to be within range of a Wi-Fi network to make it work. Unlike some other worldwide security flaws, like Heartbleed and Shellshock, the hacker cannot deploy a KRACK attack remotely.

Secondly, a hacker can only attack one network at a time. Let’s assume the would-be criminal sets themselves up in a Starbucks in downtown New York. They probably have hundreds of networks within range, but there’s no way to attack them all at once — at least, not without a van full of equipment.

As such, if cyber-criminals are thinking of launching a KRACK attack, the most likely targets are large hotels, airports, train stations, and other vast public networks with thousands of people logging on and off every day. Your home network is almost certainly safe.

The bad news? A KRACK attack has the potential to be devastating for the victim.

Can KRACK Be Fixed?

Yes, hardware manufacturers and software developers can patch and fix devices that are vulnerable to KRACK attacks. Microsoft and Apple were particularly quick off the mark — the Silicon Valley giants released beta patches on the same day the flaw was publicly announced. Google has said an Android patch will be forthcoming in the next few weeks.

Is anyone else annoyed that the WPA2 KRACK paper author sat on it for >2mos before any disclosure and 5mos before public disclosure?

However, these days we connect a lot more to our Wi-Fi than just laptops and phones. Sure, they might be the primary attack vectors, but you need to update everything from your router to your smart fridge. That takes a lot of time, and many of the companies behind the devices won’t be as responsive as Microsoft and Apple.

Your router is arguably the most critical device to update. If you’ve got an ISP-issued model, you need to start pestering the company for a patch as soon as possible.

For more information about whether your device already has a fix, check this list.

Short-Term Solutions

It seems like we might be waiting for a long time before we can definitively claim all our devices are secure. Here are some steps you can take in the meantime:

Use Ethernet: Remember, KRACK doesn’t affect the web at large, it just targets Wi-Fi connections. If you have the option to connect to a network using an ethernet cable, your device will be safe.

Use cellular data on your phone: Similarly, when on mobile, just use your data plan rather than connecting to public Wi-Fi.

As of 16:30 on 10/17/17, it seems that the article has been changed from when I read it for the first time this morning. In this morning's version, there was a statement to the effect that "while KRACK affects Windows and macOS, because of the way Linux handles WiFi, KRACK is particularly dangerous to Linux." There also was a statement that while software companies were notified about a week ago, nobody has as yet come up with any solution. IIRC, Dave suggested, tongue in cheek, that WPA3 be developed.

I find these changes very disquieting. Firstly, because the article WAS edited, deleting some of the crucial information and secondly, because I also run Linux.

" Any specific concern for linux users?"
Yes, Linux and Android 6.0 and up are especially vulnerable because of the way they manage the keys they generate for the handshake. The good news for Linux users is that many distros have already issued fixes. WEP/WPA/WPA2 in Linux are managed by "wpa_supplicant". If yours has been updated in the past day or two you should be good to go.

Dan is a British expat living in Mexico. He is currently the Social Editor for MakeUseOf. He was formerly the Creative Editor and Finance Editor. Prior to his writing career, he was a Financial Consultant. He holds various certifications from the University of Leeds, the University of Cambridge, and the…